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4. SUMMARY 


The Real-Time Failure Control (RTFC) program involves development of a failure 
detection algorithm, for the Space Shuttle Main Engine (SSME). This failure 
detection approach is signal-based and entails monitoring SSME measurement 
signals based on predetermined as well as on-line computed mean and standard 
deviation values. Twenty-four engine measurements are monitored in the algorithm 
and provisions are made to add more parameters if needed. Each of the first values 
of every measurement signal at the algorithm start is checked against safety limits 
placed around a pre-computed engine-to-engine mean value (MV) with a bandwidth 
equal to a given multiple of the pre-computed standard deviation (SD). If several 
parameters are out of the bounds of these limits a failure is signaled. During the first 
two seconds (after algorithm start) a moving average (MA) and a SD is computed on- 
line in real-time. The moving average of each parameter is computed by averaging 
the incoming signal measurement with the four most recent previous signal 
measurements. The moving average is updated at every sampling interval (40 msec) 
and is checked against a similar safety band around the initial signal value for each 
parameter. If several anomalies are registered, a failure is signalled by the algorithm. 
At the end of the two-second interval the MA is fixed as the mean value for the rest of 
the algorithm operation and a safety band is placed above and below this value equal 
to a multiple of the computed SD. However, the safety band is adjusted by adjusting 
the mean value when propellant tank repressurization and venting take place. 
"Influence Coefficients" are used to make the necessary adjustments to the safety 
limits of those parameters that are affected by repressurization and venting or valve 
closure and opening. The MA is, in both cases, continuously updated and checked 
against the safety band. Once more, if several parameters exceed the limits a failure 
is signalled. At the start of every scheduled power transient the algorithm is stopped. 
It is re-initiated after two seconds from the termination of the power transient and the 
process is repeated. 

This final report is divided into four major sections. The most encompassing of all is 
the discussion section that has sub-sections on: 1) RTFC algorithm development, 2) 
RTFC simulations, 3) RTFC current limitations, and 4) enhancements planned for. 
The report will cover background information, new developments, and future plans for 
the algorithm implementation and enhancements. 
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5. INTRODUCTION 


Anomalous behavior during Space Shuttle Main Engine' (SSME) hot-fire testing is 
presently detected via measurement redlines that monitor key measured parameters. 
In order to avoid the cost incurred and the impact on the SSME flight schedule due to 
failures, it is desirable to have an advanced failure detection system that detects 
anomalies early enough to minimize damage and that can identify as many failures as 
possible, quickly and efficiently, prior to catastrophes. The safe operation of any 
complex system, such as the SSME, rests on the reliability of the control and fault 
detection systems and the speed of detection and identification of component, sensor, 
or actuator failures. In the recent past, fault detection and isolation has raised the 
interest of many researchers [1-7]. Most major techniques to failure detection can be 
categorized as either model-based or signal-based approaches. 

Model-based techniques rely on analytical redundancy [4-8]. Analytically generated 
"measurement" outputs are compared with hardware measurements by using present 
and/or previous values of some variables in conjunction with their mathematical 
relationships. The fault detection process herein encompasses three major tasks: 1) 
residual generation that entails taking the difference between the analytical and 
measured values, 2) statistical testing and signature generation, and 3) diagnostics 
and decision making. 

On the other hand, signal-based techniques are hardware intensive and 
sensor/actuator driven. In this approach, the major undertakings include: 1) 

limit/trend checking by comparison of plant outputs with normal operational limits, 2) 
sensor/actuator/component redundancy, whereby a single value from measurements 
of several identical sensors is used according to some decision mechanism, 3) 
frequency spectrum analyses by using plant measurements, wherein frequency 
spectrums are compared with normal spectrums [9-12]. 

An algorithm is hereby developed, referred to as Real-Time Failure Control Algorithm 
(RTFCA) that permits fault detection during SSME hot-fire testing by a simple signal- 
based approach. 

The method entails monitoring the signal averages for twenty-four engine parameters 
and comparing the signal averages to upper and lower signal safety limits. The 
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reason for monitoring the averages of signals, rather than their actual values, is to 
smooth or filter out most of the undesirable effects of sensor noise. Moreover, the 
safety limits are placed above and below the fixed average value for each parameter 
with a bandwidth of n*SD, where n is a pre-determined constant that is large enough 
to avoid false alarms and small enough to make the algorithm sensitive to actual 
failures. 

The RTFC algorithm, as it is currently configured, works during SSME steady-state 
operation, starting at five seconds following engine start or two seconds following 
initiation of a new power transient. Moreover, an added safety feature is included that 
checks the value of each parameter at the first incoming measurement against upper 
and lower bounds around a predicted mean value. In case several parameters 
exceed or are below their expected limits then a failure is signalled. This feature will 
ensure the normal engine operation by identifying any failure that could have 
happened during start/power transients. Also, if any sensor indicates a negative 
output, it is automatically disqualified and eliminated from the algorithm. However, 
there is no means of overall sensor failure detection in the present set-up. 

Twelve simulations on actual data from SSME incident tests were carried out during 
the current phase of the RTFC contract. Over forty incident tests were carefully studied 
for useful information. Currently, the RTFCA. can handle only steady-state operating 
conditions. However, the start andmaly check is really a post transient failure 
detection approach that will detect any anomalous developments that happen during 
start or power transients. Moreover, there are nonlinear effects that appear in the 
behavior of some parameters. For example, the HPOT pump discharge temperature 
takes over 60 seconds to reach steady state and has an excursion of over 50°R. 
Special provisions are needed for such parameters to avoid false alarms. In addition, 
the RTFCA performance is a function of the multiplying factor n, as well as of the 
number of parameters required to show anomalous behavior for an engine shutdown 
decision. 

Nevertheless, the RTFCA as it is presently configured, is very effective (mucn better 
than redlines) in detecting slow developing failures and it is slightly better than the 
redlines in fast failures, such as structural ruptures. Several of the RTFCA advantages 
include: 1) the requirement of multiple parameter anomalies for a failure decision 
(this avoids false alarms), 2) the option of choosing a different bandwidth for different 
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parameters and even for different intervals, 3) the use of a moving average, that 
removes noise effects and is sufficiently short-term to enhance its sensitivity, 4) the 
use of SD values, computed on-line, that are characteristic of current signal behavior, 
5) the capability to account for those parameter excursions that are due to 
repressurization or venting and valve closure or opening effects, and 6) the flexibility 
of the algorithm for further expansions and enhancements, among others. 

There are means of modifying the algorithm that will make it more encompassing and 
that will be discussed in what follows. An automated selection of the optimal safety 
bandwidth, the best influence coefficients or gains for repressurization/venting and 
valve closure/ open effects, and the number of anomalous parameters required for a 
sure failure needs to be developed. Most of the shortcomings of the RTFCA can thus 
be eliminated and plans for accomplishing this will be discussed later. 

This report covers: 1) background information on past SSME failures and problems 
involving their detection, 2) detailed descriptions and simulation plots of the RTFCA, 
3) the accommodation of repressurization/venting effects as well as repressurization 
valve closure and opening effects, 4) limitations and advantages of the algorithm, and 
5) plans for future work for the enhancement of the RTFCA. 

The objective of the present contract is to further enhance the RTFCA for the SSME by 
the accommodation of and compensation for propellant tank repressurization/venting 
as well as valve/closure and opening effects, and to demonstrate the operability of the 
algorithm via engine simulations. It will be shown that the RTFCA is capable of 
detecting performance degradation and anomalous behavior of the SSME earlier and 
faster than the existing redline system. 
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6. DISCUSSION 


Fault detection system design involves several complex issues, such as quick 
response prior to significant performance degradation or damage as well as 
consideration of system redundancy. Advanced fault detection algorithms, based on 
careful consideration of system dynamic characteristics, can often lead to significant 
reduction of hardware redundancy. There are three main concerns in any fault 
detection and identification process. The primary objective invariably is to establish 
that a failure has occurred with a high degree of certainty. The type and location of 
failure as well as the extent of degradation are two of the remaining concerns that 
should be addressed appropriately. The principal thrust of the present algorithm 
involves the fault detection problem. 

6.1 BACKGROUND 

There were four major tasks identified in the statement of work of the present 
contract. These included 1) analyses of existing SSME test data to study the 
characteristic behavior due to LOX and fuel tank venting and repressurization, 
as well as repressurization valve opening/closure transient effects, 2) 
development of an analytical repressurization to account for the above 
mentioned venting/repressurization and repressurization valve opening/closing 
effects, 3) performing computer simulations to evaluate the analytical approach, 
and 4) preparation of agreed-upon documentation. These tasks also involved 
identifying the availability of sensors required to meet the enhanced algorithm. 
In addition, other areas of algorithm refinement were identified. 

Thus, repressurization and venting, as well as valve closure and opening effects 
on SSME parameters were identified and quantified. An analytical approach to 
account for these effects was incorporated in the RTFCA. In this approach, the 
signal limits are modified at each time step in an effort to track the transient 
behavior induced in the signals as a result of the above mentioned effects. The 
modifications are based on the expected parameter change per unit LOX and 
fuel engine inlet pressure change. 
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6.1.1 INCIDENTS 


The occurrence of an anomaly or a failure is classified as a “major" or a "minor" 
incident based on: a) the extent of damage, b) pressure, temperature, speed 
and vibration levels in excess of normal end item operating levels, and c) 
internal and/or external fires or explosions [13]. 

RTFC Parameter Selection Criteria [14]: 

A total of 40 tests were used to select the 24 parameters for the RTFC algorithm. 
Those measurement parameters chosen represent "key" aspects of SSME operation. 
Fifty-seven (57) measurements were examined for: a) anomaly induced percentage 
change from steady-state operation, b) rate of percentage change, c) interim from first 
indications of an anomaly to cut off. Each of the above factors were weighed and 
accordingly, the most appropriate parameters were selected for use in the algorithm. 

A database was developed whereby all the generic and specific characteristics of 
various incident tests were listed. This data was used to evaluate the significant 
parameters for failure detection use (See Ref. 15 ). 

Also included in the evaluations were failure, mode qualitative characteristics where 
generic descriptions of the incident type and a sample of indicative parameters were 
studied. Moreover, 1) sensor measurement standard deviations, 2) test-to-test 
envelope database definition, 3) data for time-sliced value deviations from the 
average steady-state sensor measurements, and 4) 31 database inputs for each test 
were also studied. 

Generated was information on engine parameters, mean values and standard 
deviations from actual and simulated data. For instance, for the high pressure oxygen 
turbopump (HPOT) discharge temperature channel B values, the engine-to-engine 
standard deviation for the predicted value at the 109% power level is 61.07373 while 
the actual value is 118.6592 (almost double). Differences of the above mentioned 
nature raise the concern of using pre-computed means and standard deviations. This 
fact is the fundamental reason for choosing the first incoming value of each parameter 
measurement as the basis for determining the actual mean value to be used by the 
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algorithm during its first two-second operation rather than using a pre-computed 
value. 


6.1. 1.1 SAMPLE INCIDENT DESCRIPTIONS 

There are two major types of incidents: 1. Fast occurring structural failures, and 2. 
Slow occurring anomalies that build up over a longer duration. To provide a taste of 
such anomalies, a sample incident is described below. 

1. Test No. 902-428 

Scheduled Duration (SDUR) = 700 seconds 
Achieved Duration (ADUR)= 204.12 seconds 
Engine NO. 2106 
Date: July 1, 1987 

Engine performance was nominal until engine start plus 163 seconds. At 163 
seconds, HPOT discharge temp in Channel A (CHA) began to rise indicating the 
presence of a hot streak in the OPB injector, HPOT discharge temp in Channel B 
(CHB) did not respond. The hot streak was localized and due to the rotating 
effect of the turbine, only a Channel A sensor responded. 

Post test examination revealed erosion of the oxidizer preburner injector face 
and localized burn-through of the HPOTP turbine sheet metal adjacent to the 
injector erosion area. There was no external engine damage and heating was 
isolated to the areas noted above. 

REDLINE PARAMETER - HPFT discharge temp sensors (231,232) dropped 
below their lower limit. Pneumatic shutdown was initiated because a hydraulic 
lockup was in effect (part of the test plan). 
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6. 1 . 1 . 2 SELECTION OF TESTS FOR RTFC SIMULATIONS 


From past test histories, a selection of incident tests was derived for the purpose of 
simulations with the RTFC algorithm using real-test data. The selection was based on 
the need to cover a wide range of failure types. Thus, failures that have been 
simulated on the RTFC algorithm previously, failures that were representative of the 
most critical and most recurrent anomalies, as well as those that represented fast or 
slow occurring failures, both with and without repressurization/venting, were selected. 
Moreover, tests that were nominal and had repressurization and venting as well as 
valve closure/opening were also simulated. The selected list of incidents is presented 
in Table 6.1. 

6.1.2 PARAMETER IDENTIFICATION (PID) NUMBER ASSOCIATION WITH TESTS 

Every individual measurement parameter is associated with a PID number for each 
specific engine test. These PID numbers often change from test to test and from 
engine to engine, since in some cases, new sensors are added and in others, existing 
ones are removed. Thus, the redistribution of the measurement sensors create the 
need to identify the PID numbers for each test. 

Processing test data of the SSME includes storage of measurement values in 
computer files that only accommodate 9 PIDs per file (meaning 9 measurements). 
This is apparently necessary for the failure mode effects analysis (FMEA) that is 
carried out after every failure occurrence. 


6.1.3 CHARACTERISTIC EFFECTS OF REPRESSURIZATION 
AND VENTING ON RTFC PARAMETERS 

During SSME testing, the LOX tank or the fuel tank, or both are either pressurized or 
vented several times during the course of a test in virtually every test. These 
repressurization/venting processes effect some of the parameter values over and 
above the power level variation effects. Eleven of the twenty-four monitored 
parameters are significantly affected by venting/pressurization of the oxygen tank. On 
the other hand, venting/repressurization of the fuel tank significantly affects only one 
parameter, the LPFTP speed. Additionally, closing of the fuel and GOX 
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repressurization valves results in rapid changes, essentially step function responses, 
in some parameters. Two parameters, the PBP discharge pressure and the LPFTP 
speed, are affected upon closing the fuel repressurization valve. One parameter, the 
HEX venturi delta-pressure, is affected upon closing the GOX repressurization valve. 

Analyses on various engine data with and without LOX venting was carried out. 
Clearly, almost all parameters are affected, but only about half are significantly 
affected as to necessitate accommodation of the effects in the algorithm. Well-defined 
procedures are utilized to incorporate the effects of tank venting and pressurization as 
well as of repressurization valve closures on the RTFC parameters using existing 
SSME "influence coefficients." 

6.2 RTFCA OBJECTIVE AND SCOPE 

The main objective of the Real-Time Failure Control contract is to develop a real-time 
failure detection algorithm that is signal-based and that detects anomalous behavior 
of the SSME earlier than the existing redline system. 

The RTFCA works, as it currently stands, only during SSME steady-state and 
repressurization and venting transient test conditions. It utilizes both low and high 
frequency measurement signals from twenty-four key parameters that are currently 
monitored. However, the option of expanding the monitored parameter list would not 
require extensive effort. Eight of these parameters are facility and sixteen are CADS. 
All major redline parameters are included, based on the fact that all these are key to 
safe engine operation. 
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6.2.1 THE CURRENT RTFC ALGORITHM 


The RTFC algorithm in its present configuration starts at five seconds following engine 
start or two seconds following initiation of a new power transient. As a safety feature, 
the first measurement values (after algorithm start) of all the twenty-four monitored 
parameters are checked against safety limits formed by placing a safety band of 
N*SD p , where N is a predetermined multiplying factor (normally 4) and SD p is the 

pre-computed SD. If several parameters (the number of which should be decided 
prior to a test, usually between 3 and 6) violate these limits then an engine shutdown 
is signalled. This check will detect any anomalous behavior that could have 
developed during start or a power transient. If no failures are detected at the first 
instant then the first measurement values of the twenty-four parameters are chosen as 
the mean values for the first two-second interval of the algorithm operation (i.e. first 
two-second failure detection). During this time an on-line real-time SD p and a moving 

average (MA) are calculated. The latter is the average of 200 milliseconds worth of 
data for each parameter. This MA is updated at every sampling interval (40 
milliseconds) by dropping the last value of the measurements and picking up and 
adding on the most recent one. This MA is checked against a safety band formed by 
placing safety limits around the above mentioned fixed average (the first incoming 
measurement value) of N-|* SD p bandwidth (where Ni is a predetermined weighting 

factor). If several parameters simultaneously indicate anomalous behavior, an engine 
shutdown is signaled. Figures 1 and 2 show schematics' of the RTFC algorithm's 
software structures and the operational features. 

If no anomalies are detected during this two-second interval, and no repressurization 
or venting occurs, then the last computed MA is fixed as the mean value (MV) for each 
particular parameter for the rest of that power level (i.e. steady-state interval failure 
detection). A safety band is formed around this fixed MV by placing limits (above and 
below it) of N 2 * SD c (where N 2 is a weighting factor and SD C is the calculated SD). 

Then the on-line MA, that is continuously being updated, is checked against these 
safety limits at every sampling interval until the start of a scheduled power transient. If 
several parameters indicate violation of the safety limits, an engine shutdown is 
signalled. 
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In case of repressurization and venting, the MV of each parameter is adjusted, based 
on power levels and gain values derived from "influence coefficient" data. Moreover, 
the limits are also adjusted accordingly. 

This process is stopped at the initiation of every scheduled power transient and is re- 
started two seconds thereafter, allowing time for the transient effects to settle out. For 
a visual picture of the algorithm operation see the schematic in Figure 2. 

6.2.2 REPRESSURIZATION/VENTING AND VALVE CLOSURE/OPENING EFFECTS 

Test Analyses: 

Several tests, that were performed on test stands A1, A2 and A3 as well as tests from 
the technology Test Bed (TTB) engines, were analyzed and the effects of 
repressurization and venting (of LOX and fuel) were evaluated for various engine 
parameters. Tests 750-285, 801-008, 801-009, 801-011, 901-173, 901-340, 901-364, 
901-498, 901-511, 901-550, 901-551, 902-398, 902-415, and 902-428 were 
examined for OPOV and FPOV actuator position as well as LPFP speed and HPFP 
discharge pres-sure changes due to repressurization and venting effects (as shown in 
Figures 3-7). Moreover, nine such tests were analyzed for the HPOT Discharge 
Temperature and HPFT Discharge Temperature. The tests studied included all of the 
above tests except 750-285, 901-173, 901-340, 901-364 and 801-008. Both Channel 
A and Channel B data were analyzed (see Figures 8 and 9). The test profile plots for 
some of the above mentioned tests were not available. However, test profiles for 750- 
285, 801-008, 801-009, 801-011, 901-173, 901-340, 901-364, 901-498, 901-511, 
901-550, 901-551, 902-398, 902-415, 902-428, and 901-364 are shown in Figure 10. 

Indications are that all of the above mentioned parameters are significantly effected by 
LOX repressurization and the effect of LOX venting is smaller but still measurable. 

LOX repressurization decreases the OPOV opening by about 2.5% for 165 OPI 
(Oxidizer Pressure at Inlet). While only 1.5% reduction of the valve opening is 
registered for -80 NPSP venting at 107% RPL (see Figures 3). The effect of LOX 
venting and repressurization on the HPOT and HPFT Discharge Temperatures is 
similar. 
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Thus, LOX venting down to -20 NPSP increases the HPOT Discharge Temperature 
from 1290° to 1345° while repressurization up to 165 OPI (Oxidizer Pressure Inlet) 
reduces' it from 1345° F to 1245° F at 104% RPL. These effects are even stronger at 
109% RPL (which are currently being looked at (see Figures 8)). The thrust profiles of 
some of the above mentioned tests that were studied provide the 
venting/repressurization profiles as well as the power levels at various time slices 
(See Figure 10). 

LOX repressurization decreases the LPFP speed by about 0.75 rpm/sec. for 47 NPSP. 
While only a minor change (.15 rpm/sec.) of the speed is registered for an equal 
degree of venting at 90% RPL (see Figure 5). The effect of LOX venting and 
repressurization on the HPFT Discharge Pressure is similar (Figure 6). Thus, LOX 
venting down from 220 psia to 135 psia increases the HPFT Discharge Pressure from 
6728 psia to 6758 psia while repressurization from 90 psia to 220 psia reduces it from 
6750 psia to 6720 psiaat 109% RPL. One of the tests, 902-398 indicates nonlinear 
behavior of the HPFP Discharge Pressure (see Figure 7). This is not seen in any 
other tests. Hence, it could have been a sensor problem. 

It was found that fuel venting affected the Low Pressure Fuel Turbopump, (LPFTP) 
speed. A decrease of about 0.85 RPM/psi for fuel repressurization. Although it was 
noticed that very seldom fuel repressurization is performed (tests normally include 
only fuel venting). In addition, the High Pressure Fuel Pump (HPFP) radial 
accelerometers are also slightly affected by fuel repressurization amplitude by an 
increase of about 0.06g, and venting reduces it by about the same amount. 

Out of the 24 RTFC monitored parameters, only 3 seem to be affected by 
opening/closing the fuel and GOX repressurization valves. The HPOTP Boost Pump 
(or, as it is more often called, the Preburner Boost Pump (PBP)) discharge pressure 
rises by 20 psi when the fuel repressurization valve is opened and drops by 20 psi 
when it is closed. The Low Pressure Fuel Pump (LPFP) speed, on the other hand 
increases by about 90 RPM when the fuel repressurization valve opens and 
decreases by about the same amount when it is closed. 
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The Heat Exchanger (HEX) Venturi delta pressure drops down by about 68 psi when 
the Gaseous Oxidizer (GOX) valve closes. Table 2 summarizes the effects of fuel/LOX 
venting/repressurization and repressurization valve opening/closure as a result of 
examination of actual test data 

Analytical Approach: 

An analytical approach to account for the effects of propellant tank venting and 
repressurization has been incorporated into the RTFC algorithm. The signal limits are 
modified at each time step in an effort to track the transient behavior induced in the 
signals as a result of tank venting and repressurization. The signal limits are 
computed by the standard methods used for steady-state behavior at algorithm start 
and again at two seconds following algorithm start, respectively. These signal limits 
are then modified at each time step according to any change in fuel and LOX inlet 
pressures and the corresponding "Influence Coefficient " (1C) values. 

These 1C, or gain, values represent the expected parameter change per unit fuel or 
LOX engine inlet pressure change. Thus, the computational expressions for the 
signal limits consist of three components which represent signal behavior due to: 1) 
steady state behavior, 2) LOX venting and repressurization effects, and 3) fuel venting 
and repressurization effects. 

The ICs were derived by both SSME Power Balance model (PBM) and SSME Digital 
Transient model (DTM) calculations as well as from the data analyses of actual tests 
discussed previously. The first approach encompasses generating perturbations in 
the PBM by changing a given independent engine parameter by a certain amount at 
each specified power level, ranging from 65% to Rated Power Level (RPL) to 109% 
RPL, to compute the effects on all the dependent parameters at each of these power 
levels. Generally no assumption of cavitation of the High-Pressure Oxidizer Pump 
(HPOP) or even the High-Pressure Fuel Pump (HPFP) was made. There are 
independent parameters to simulate various degrees of HPOP and HPFP cavitation, 
that can occur at minimum LOX inlet and fuel inlet pressures or under poor hardware 
conditions. 
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The 1C generation includes the comparison of each perturbed value of a parameter to 
a nominal value at each power level and the creation of' a least-squares curve fit of up 
to order three, which approximates the percent change in each dependent variable at 
a given power level for a known dependent parameter perturbation. The coefficients 
of these equations, that result from the curve fits are the ICs. These can be represent- 
ed as a matrix of independent and dependent parameters of engine operating 
conditions. Only those parameters that had larger than 2% change in their percent 
variation were evaluated. Table 3 summarizes the effects of LOX tank 
venting/repressurization based on PBM calculations. 

For a given power level the 1C of a certain parameter can be found from the following 
equation: 


1C = Ao+A, *PL + A 2 *PL + A 3 *PL 

Where A 0 , A t , A 2 , A 3 are the coefficients of the curve-fit and PL is the ratio of actual 
power level to the RPL. This number is the percent change in the dependent para- 
meter for a 1% change in the independent parameter. Thus, 

dD . dl 
IC = — * — 

D I 

Where d (.) is the perturbation of the dependent or independent variables. The total 
gain will then be the IC multiplied by the actual value of the parameter measurement 
signal. 

An analytical approach to account for the effects of opening and closing the fuel and 
GOX repressurization valves has also been formulated and incorporated into the 
algorithm. Only three of the twenty-four parameters are significantly affected, and 
show either a step increase or decrease at the time of valve opening or closing. The 
amounts by which these parameters change are indicated in Table 6.2.2.I. 


RSS-8826-28 
- 14- 



TABLE 6.2.2. 1 


ID 

Parameter 

Fuel Valve Ooen 

Fuel Valve Close 

GOX Valve Close 

6 

HPOTP Boost Pump Dis Pres 

+20 psi 

-20 psi 

N/E 

16 

LPFTP Speed 

+90 rpm 

-90 rpm 

N/E 

21 

HEX Venturi Delta-Pres 

N/E 

N/E 

-68 psi 


Extensive SSME hot-fire test data has been analyzed and actual variations of 
dependent parameter values have been evaluated based on known variations of 
independent parameters. Thus, at various power levels, known variations in tank 
pressures (independent variables) were studied against the effects on all twenty-four 
engine parameters (dependent variables) that are currently monitored. Then, the 
gains were derived based on actual calculations of the percent change of each 
dependent variable at a given power level for a known independent variable 
excursion. 

6.2.3 COMPUTER SIMULATIONS 

In this task, SSME hot-fire test data was used with the algorithm to evaluate the 
enhanced algorithm's performance due to 1) propellant tank venting and 
repressurization, and 2) repressurization valve opening/closure effects. Moreover, 
incident test data was also used on the enhanced algorithm to show the improved 
performance with the modifications. A brief description of the tests and algorithm 
simulation results for the twelve hot-fire tests simulated during this phase follows. 

The tests in (i) through (vi) presented below were selected for simulation because 1) 
the tests ran for the full planned duration, 2) the tests did not involve any anomalies, 3) 
venting and/or repressurization of the LOX tank was performed, and 4) venting of the 
fuel tank was performed. Simulations were made of these nominal tests to establish a 
set of gain values for the monitored parameters which reflect the nominal signal 
behavior as a result of tank venting/repressurization procedures. 

The tests presented in (vii) through (x) involved both the tank venting/repressurization 
procedures and engine failures. These simulations were made to evaluate the 
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algorithm's performance in detecting anomalous behavior under tank 
venting/repressurization conditions. 

Two additional tests were simulated, presented in (xi) and (xii). Neither of these tests 
involved the tank venting/repressurization procedures. Both tests involved a main 
injector failure. Since both failures were structural, the failures occurred rapidly. The 
simulations resulted in algorithm shutdown signals slightly before the redlines. 

(i) Test 902-398 

The thrust profile for test 902-398 is presented in Figure 1 1 LOX tank venting was 
initiated at 80 seconds followed by repressurization at 160 seconds and venting again 
at 240 seconds. Fuel tank venting was initiated at 10 seconds. The simulation was 
performed at 104% RPL between 13 and 300 seconds. Figures 12 and 13 show the 
behavior of the LOX and fuel engine inlet pressures during venting and 
repressurization, respectively. Figures 14 through 20 show the signal behavior and 
signal limits of selected parameters during LOX/fuel tank venting and 
repressurization. Figures 18 and 19 show the HPOTP Boost Pump discharge 
pressure and LPFTP speed signals and signal limits. The fuel repressurization valve 
is closed at 250 seconds, at which time these parameters show 20 psi and 90 rpm 
step drops, respectively. Figure 20 shows the HEX Venturi delta-pressure signal and 
signal limits. The GOX repressurization valve is closed at 270 seconds, at which time 
the HEX Venturi delta-pressure drops by 68 psi. 

(ii) Test 901-511 

The thrust profile for this test is presented in Figure 21. The simulation was performed 
at 104% RPL between 13 and 410 seconds. Venting/repressurization of the LOX tank 
was performed twice during this test, at 80 seconds and at 295 seconds. Fuel tank 
venting was initiated at 10 seconds. The fuel and GOX repressurization valves were 
closed at 250 and 270 seconds, respectively. Figures 22 and 23 show the behavior of 
the LOX and fuel engine inlet pressures during venting and repressurization, 
respectively. Figures 24 through 29 show the signal behavior and signal limits of 
selected parameters during LOX tank venting/repressurization. In addition, Figures 
28 and 29 show the signal limit adjustments made at the time of closing the fuel and 
GOX repressurization valves. 
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(iii) Test 901-551 


The simulation of this test was performed between 70 and 395 seconds at 104% RPL. 
The thrust profile, presented in Figure 30 indicates LOX tank venting/repressurization 
was initiated at 80 seconds. Fuel tank venting was initiated at 10 seconds. The fuel 
and GOX repressurization valves were closed at 300 and 320 seconds, respectively. 
Figures 31 and 32 show the LOX and fuel engine inlet pressure signals. Figures 33 
through 36 show the simulation results for selected parameters. 

(iv) Test 901-683 

The simulation of this test was performed between 70 and 330 seconds at 104% RPL. 
The thrust profile, shown in Figure 37, shows that LOX and fuel tank 
venting/repressurization was scheduled for 80 seconds and 10 seconds, respectively. 
The fuel and GOX repressurization valves were closed at 300 and 320 seconds, 
respectively. Figures 38 and 39 show the LOX and fuel engine inlet pressures. 
Figures 40, 41, and 43 show the simulation results of three parameters affected by 
LOX tank venting/repressurization Figures 42 and 43 show the effects on two 
parameters of closing the fuel and GOX repressurization valves. 

(v) Test 902-519 

The simulation of this test was performed between 69 and 395 seconds at 104% RPL. 
The thrust profile is shown in Figure 44. LOX tank venting/repressurization was 
initiated at 80 seconds. Fuel tank venting was initiated at 10 seconds. The fuel and 
GOX repressurization valves were scheduled closed at 300 and 320 seconds, 
respectively. Simulation results of selected parameters are shown in Figures 47 
through 50. 

(vi) Test 902-532 

The thrust profile and venting schedules for this test were the same as for test 902-519 
(Figure 51). The simulation was performed beginning at 69 seconds upon throttling to 
104% RPL. The simulation results of selected parameters are presented in Figures 
54 through 57. 
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(vii) Test 902-249 


Test 902-249 involved failure of the HPFTP. Damage incurred includes HPFTP 
turbine blade damage and rupture of the volute. The test was shut down at 450.57 
seconds due to a HPFTP radial accel redline. The anomaly report indicated that 
some anomalous behavior was apparent soon after start. Subsequent indicators 
included a drop in the HPFTP synchronous level at 162.9 seconds and a rise in one of 
the HPFP radial accels around 250 seconds. 

The algorithm simulation was performed beginning at 12 seconds upon throttling to 
109% RPL. Figure 58 shows the thrust profile. Figure 59 shows the LOX engine inlet 
pressure profile indicating initiation of venting at 20 seconds and repressurization at 
95 seconds. Venting/repressurization of the fuel tank was not performed during this 
test. 

Figures 60 through 66 present the profiles of the seven parameters for which the 
algorithm would detect anomalous behavior at the earliest time. By 329 seconds, 
three parameters exceeded their safety limits: the HPFTP coolant liner pressure 
(Figure 60), the HPOP intermediate seal purge pressure (Figure 61), and the HPFTP 
discharge temperature channel B (Figure 62). By 360 seconds, two additional para- 
meters exceeded their safety limits: the HPFT discharge temperature channel A 
(Figure 63) and the fuel flowmeter (Figure 64). A sixth parameter, the FPOV actuator 
position, exceeded its safety limits at 374 seconds (Figure 65). A seventh parameter, 
the HPFP balance cavity pressure, exceeded its safety limits at 395 seconds (Figure 
66 ). The algorithm would signal a shutdown 121 seconds earlier or 90 seconds 
earlier than the redline due to detection of anomalous behavior in three or five 
parameters, respectively. 

(viii) Test 902-428 

Test 902-428 involveo failure of the OPB injector. The test was shut down at 204.12 
due to a HPFTP discharge temperature redline. The algorithm simulation was 
performed beginning at 16 seconds upon throttling to 104% RPL Figure 67 shows the 
thrust profile. Figures 68 and 69 show the fuel and LOX engine inlet pressure profiles. 
Fuel tank venting was initiated at 10 seconds. Venting/repressurization of the LOX 
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tank was initiated at 80 seconds. Closure of the fuel and GOX repressurization valves 
was scheduled beyond the time of the redline shutdown time. Nine of the algorithm 
parameters exceeded their safety limits. The HPOT discharge temperature 1 
exceeded its limit the earliest at 168 seconds. By 190 seconds, three additional 
parameters had exceeded their safety limits, fourteen seconds earlier than the HPFTP 
discharge temperature redline. The profiles of four parameters which exceeded their 
safety limits that were also affected by LOX tank venting/repressurization are shown in 
Figures 70 through 73. 

(ix) Test 901-364 

Test 901-364 involved failure of the HPFTP. The test was shut down at 392.16 
seconds due to a PBP radial accel redline. The algorithm simulation was performed 
beginning at seventy one seconds upon throttling to 109% RPL. Figure 74 shows the 
thrust profile. Figures 75 and 76 show the fuel and LOX engine inlet pressure profiles. 
Fuel tank venting was initiated at 100 seconds. Repressurization and venting of the 
LOX tank was initiated at 200 seconds. The failure occurred suddenly. Four of the 
algorithm parameters exceeded their safety limits. The HPFP speed exceeded its limit 
the earliest at 384 seconds. Three additional parameters exceeded their safety limits 
by 386 seconds, six seconds earlier than the PBP radial accel redline. Only three of 
the remaining algorithm parameters showed indications of the failure. These did not 
exceed their safety limits, however. The profiles of the four parameters which 
exceeded their limits are shown in Figures 77 through 80. 

(x) Test 750-175 

Test 750-175 involved a high pressure oxidizer duct rupture and was shut down at 
116 seconds by a LOX preburner pump accel redline. The failure occurred suddenly 
and is apparent in only three of the algorithm controller parameters: the LPOP 
discharge pressure and the OPOV and FPOV actuator positions. Since the test was 
shut down by the redline shortly following initiation of the failure, the algorithm did not 
detect the failure earlier than the redline. 

The algorithm simulation was performed over two power levels: 1) between 12 and 
100 seconds at 109% RPL, and 2) between 102 and 115.6 seconds at 111% RPL. 
Figure 81 shows the thrust profile. Figures 82 through 87 show the simulation results 
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at the two consecutive thrust levels, 109% RPL and 111% RPL, for the HPFP speed, 
the LPOP discharge pressure, and the FPOV actuator position. 

Venting/repressurization of the LOX tank was initiated at 10 seconds. The LOX tank 
venting effects could not be not simulated in the safety limits because data for the LOX 
tank inlet pressure (facility parameter) was only available at a sampling rate of 16 and 
17 msec. This is an unusual sampling rate and is not compatible with the algorithm 
which requires facility data each 20 msec. 

(xi) Test 901-183 

A simulation was made of test 901-183 which involved a main injector failure. This 
test did not involve propellant tank venting procedures. The test was shut down at 51 
seconds by a HPFP radial accel redline. The algorithm simulation was performed 
beginning at 5 seconds upon throttling to 92% RPL. The algorithm signalled a 
shutdown at 50.35 seconds due to detected anomalies in five parameters, 0.65 
seconds earlier than the redline. The thrust profile is shown in Figure 88 The FPOV 
actuator position signal exceeded its safety limit the earliest at 50.234 seconds 
followed by the MCC chamber pressure at 50.275 seconds (Figures 89, 90). Three 
signals exceeded their safety limits at 50.355 seconds: the HPOTP discharge 
pressure, the PBP discharge pressure, and the fuel flow (Figures 91 through 93). 

(xii) Test 901-173 

Test 901-173 involved a main injector failure and was shut down at 201.17 seconds 
due to a HPFT discharge temperature redline. The thrust profile is shown in 
Figure 94. Pressurization of the fuel tank was performed at 90 seconds. Lox tank 
venting was scheduled at 460 seconds but was not performed due to the failure. The 
simulation was performed for both scheduled power levels of 70% RPL and 92% RPL. 
The simulation at 70% RPL was performed from 5 seconds to 100 seconds. The 
simulation at 92% was performed from 103 seconds to 201.16 seconds. The 
simulation resulted in a shutdown at 201.02 seconds due to detected anomalies in 
four parameters, 0.15 seconds earlier than the redline. Anomalies were first detected 
in the HPFTP discharge pressure at 165.67 seconds, the HPFTP radial accel at 
176.18 seconds, and in the HPOTP discharge pressure and the HPFTP balance 
cavity pressure at 201.02 seconds. Since the failure was structural, the failure 
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occurred rapidly and therefore was detected by both the redline system and the 
algorithm fairly quickly. The four parameters which exceeded their safety limits are 
shown in Figures 95 through 102, for both power levels. 

The gain values characterizing the LOX and fuel tank venting/repressurization effects 
for ten simulated tests are presented in Tables 4 and 5, respectively. These values 
represent the expected parameter change per increase in engine inlet pressure. Most 
of the signal gain values do not vary among the different tests, indicating fairly 
consistent behavior as a result of these facility processes from test to test. The LOX 
tank venting/repressurization gain value for the HPOT discharge temperature shows 
the most variation ranging from -1.0 to -1.8 degrees R per unit inlet increases in LOX 
tank pressure. 

The signal step changes due to closing the GOX and fuel repressurization valves are 
summarized in Tables 6 and 7, respectively. The opposite effects result if these 
valves are opened. The resulting signal behavior showed virtually no variation from 
test to test, as indicated in the values of Tables 6 and 7. 

Tables 8 through 13 present data used to compute the signal safety limits for the 
twelve simulated tests. The tables also indicate the power levels that were simulated 
for each test. Table 8 presents the estimated mean values used for the first instant 
check safety limits. Table 9 presents the mean values computed on-line over the first 
two-second duration of each power level. Tables 10 and 12 present the pre- 
computed SD values and the N1 factors, respectively, used for the first two-second 
interval failure detection safety limits. Tables 11 and 13 present the SD values 
computed on line and the N2 factors, respectively, used for the steady-state interval 
failure detection safety limits. 
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6.2.4 RTFC ALGORITHM ENHANCEMENTS 


In addition to the code enhancements to model the effects of tank venting/repressuri- 
zation and repressurization valve closure, several additions have been made to the 
algorithm code to enhance the safety limits and the shutdown criteria. These include 
the following: 

1 . A backup approach to compute, for a given parameter, the safety limit band- 
width during the nominal phase to be 75% of that during the initial two-second 
phase if (i) the on-line standard deviation value is computed to be near zero 
(i.e., 0.005 * pre-computed SD), or (II) the safety limit bandwidth is computed 
to be larger during the nominal phase than during the initial two-second 
phase; 

2. Logic to provide that if a sensor reading is zero or negative for any parameter, 
that parameter is eliminated from the algorithm computations and will not be a 
factor in signaling a shut down; and 

3. The comparison of the HPFP and the PBP radial accelerometer signals to 
upper safety limits only since these parameters are not constrained to a 
minimum value for nominal operating behavior. 
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6.3 LESSONS LEARNED 


During the course of the present contract, several features of the SSME were 
investigated in detail. Information, useful for future failure detection algorithm 
development, was analyzed and recorded. Thus, transient effects other than the start 
and power transients, were found to significantly influence parameter values. If these 
effects are not compensated for, the failure detection algorithm will lose some of its 
sensitivity to failures and thus be more sluggish. Nonlinear behavior of several 
SSME parameters, inherent to engine characteristics, need to be addressed. These 
effects were termed nonlinear because of the characteristic shape that each 
parameter takes in time even in the absence of any venting/repressurization or other 
transient phenomena. For example, it takes over 75 seconds for the HPOT turbine 
discharge temperature, the MCC liner cavity pressure, and the HPOT secondary seal 
cavity pressure to reach steady state. The HPOP intermediate seal purge pressure 
requires nearly 200 seconds to reach steady state (Reference 15). Figures 103 
through 106 present some parameters exhibiting this type of behavior. 

If these parameters are to be monitored, then it is necessary to develop estimates of 
their nominal mean values for piecewise linear intervals or define functions 
representative of the nominal signal behavior. If the signal behavior can be closely 
represented, then the safety band around it can be made smaller resulting in 
increased algorithm sensitivity. 

Start and power transients are the most difficult areas to be tackled. However, the 
power transients seem to be relatively easier to track. Hence, the plan for the next 
phase is to study and modify the power transients. 
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7. CONCLUSION 


Extensive computer simulations with the RTFCA on real SSME incident and nominal 
test data indicate significantly earlier cutoffs than achieved with the existing redline 
system. Cutoffs were found to be a function of the kind of failure that occurred, the 
speed with which it progressed and the location and degree of localization of the 
anomalies. In fast occurring failures, such as ruptures or breakage of structural areas, 
the RTFCA resulted in only slight gains over the redlines. For slow occurring failures, 
however, the RTFCA showed significantly earlier shutdown capability. 

Two factors are important in the decision for engine cutoff. Firstly, the performance of 
the RTFCA depends heavily on the choice of the weighting factor (N) that determines 
the bandwidth of the safety limits placed around the average value of each monitored 
signal. Secondly, the algorithm's performance depends on the gain values required 
for the signal limit adjustments needed in simulating repressurization and venting 
effects. Moreover, the algorithm has a requirement for multiple anomalous signals 
prior to signaling an engine cutoff command. This number should be predetermined 
prior to each test. There is presently no procedure for the selection of these factors 
other than experience and trial and error. However, work has been performed on 
finding ways of automatically determining these numbers at the start of the algorithm 
during a test. 

The RTFCA, as it currently stands, can handle steady-state test operating conditions 
and repressurization and venting conditions. It is turned off during the start transient, 
as well as during power transients. However, the first instant check that the algorithm 
is equipped with (that checks the value of each of the first incoming measurement 
signals against a pre-computed nominal expected value) is for detection of 
anomalous behavior that might have occurred during a transient. This feature 
provides some degree of fault detection capability at start or power transients. 
Moreover, the option of expanding the capability to handle transients, as well as other 
nonlinear behavior and excursions, are under consideration and plans for such 
augmentation exist. The algorithm monitors more parameters than the redlines, witn 
the option of expanding the list even further. Also, the RTFCA avoids “false alarms" by 
the above mentioned requirement for multiple simultaneous anomalous signals prior 
to a decision for engine shutdown. 
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The current algorithm does not encompass an approach for sensor failure detection 
with the exceptions of zero and negative sensor readings. These and other limitations 
of the RTFC can be addressed and its effectiveness and scope can be enhanced 
given appropriate planning, analyses, simulations, and judicious approaches. 
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8. RECOMMENDATIONS 


By all means, it is highly desirable to develop a failure detection algorithm for the 
SSME that can operate under all conditions (steady-state and transient) and that is 
sensitive enough to detect slow and fast occurring failures at such an early stage that 
damage to the engine is minimized. There are certain approaches that, if taken, can 
lead to the above mentioned enhanced and expanded algorithm. In this section a few 
tasks are outlined that will accomplish some of the enhancements. 

8.1 FAILURE DETECTION 

The fault detection problem involves a thorough and realistic understanding and 
specification of the given system. The various failure modes that may occur can be 
described as either fast occurring and progressing or as incipient (slow developing) 
faults. Fault detection is approached either via model-based or signal-based 
techniques. For analytical redundancy purposes some kind of validation of nominal 
relationships of the given system, using the actual input and the measured output, are 
carried out and the dynamics of the system are evaluated on-line in a real-time 
manner. 

Most advanced fault detection schemes suffer from complexity and often from inherent 
weakness in reliability. However, it is usually possible to develop simple fault 
detection schemes that do not require extensive analytical development and that work 
reliably and efficiently. Such an approach involves the use of the SSME DTM. 

Analytical redundancy, especially when applied to key engine parameters, can 
provide significant reliability and enhanced performance, especially under sensor 
failures. A good analytical model of the engine is required that can predict the 
expected outputs very closely (to that of the actual values) and thus provide analytical 
values to compare actual outputs with and make a decision regarding the status of the 
sensor. The SSME DTM is a very effective tool that can be utilized for such analytical 
redundancy purposes (perhaps piecewise linearization will be required in order to 
make it real-time on-line applicable). There are many key sensors that need such 
redundancy and that when implemented can enhance engine performance, avoid 
engine shutdowns due to false alarms, and that can minimize damage from failures. 
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8.2 SENSOR FAILURE DETECTION 


Throughout the history of the Space Shuttle program, the only SSME in-flight 
shutdown occurred during flight 51 F July 30, 1985, due to the malfunction of the HPFT 
discharge temperature sensors. This type of failure can be easily avoided given a 
good (simple) sensor failure detection approach. 

Such an approach was evaluated using the information from past engine data as well 
as simulations via the SSME DTM. It is clearly indicated in the sensor outputs from 
flight 51 F (Reference 15) that the only parameters that showed anomalous behavior 
were the two HPFT discharge temperature sensors, while all the other parameters 
were nominal. This is sufficient cause to believe that it is a sensor failure. A change in 
any one of the SSME parameters, results in a corresponding change in each of the 
other sensor outputs. Thus, sensor outputs can be correlated in such a manner as to 
generate useful information regarding the status of sensors. 

The implementation of such a scheme is straight forward, does not require extensive 
computational effort, and can significantly enhance the performance of the SAFD 
algorithm. 

8.3 RTFC PERFORMANCE ENHANCEMENTS 

In accordance with the observations made in the previous pages, it is highly 
recommended that work be continued on the RTFC algorithm development and 
enhancements directed towards expanding the capabilities of the algorithm. These 
expansions should address RTFC operation during start and power transients, and 
accommodations and compensations for nonlinear effects. In addition, sensor failure 
detection schemes should be simulated that are simple and easy to implement in 
order to study their feasibility and effectiveness. 
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The capability exists at Rocketdyne to evaluate the SSME from a systems point of 
view and develop failure detection schemes based on practical implementation and 
feasibility issues and formulated on sound mathematical and advanced fault detection 
knowledge. Advanced observer-based estimation routines can be utilized, using the 
DTM, that can provide analytical redundancy and enhanced failure detection 
capability. Various options have already been studied and their feasibility has been 
evaluated. 

This useful effort should continue without the slow-down of unnecessary contractual 
breaks in order to have the engineers devote their full attention to the important task of 
SSME failure detection. 
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APPENDIX I. 
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TABLE 1. 

SIMULATED TESTS DURING 1991-1992 


1 . 

902-398 

7. 

902-249 

2. 

901-511 

8. 

902-428 

3. 

901-551 

9. 

901-364 

4. 

901-683 

10. 

750-175 

5. 

902-519 

11. 

901-183 

6. 

902-532 

12. 

901-173 
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TABLE 2. 

PRELIMINARY ESTIMATES OF 

SSME REPRESSURIZATION/VENTING AND VALVE CLOSURE/OPENING 
EFFECTS ON ENGINE PARAMETERS AT 104%RPL 

FUEL FUEL GOX 


NO. 

PARAMETER NAME 

PID 

NUMBER 

FUEL 

VENTING 

LOX 

VENTING 

LOX 

REPRESS. 

VALVE 

OPEN 

VALVE 

CLOSE 

VALVE 

CLOSE 

1 

HPFTP SPEED 

260-261,764 

NE 

NE 

NE 

NE 

NE 

NE 

2 

HPFTPT. DIS. TEMP 

231-232 

NE 

NEGLIGABLE 

0.5 

NE 

NE 

NE 

3 

HPFTP DIS. PRESS. 

52,152 

NE 

+0.25 PSI/PSI 

-0.25 PSI/PSI 

NE 

NE 

NE 

4 

HPFTP RAD. ACCEL 

1981-85 

+0.07 g/PSI 

NE 

NE 

NE 

NE 

NE 

5 

HPFTP CL. LNR. PR. 

53,54 

NE 

NE 

NE 

NE 

NE 

NE 

6 

HPFTP BAL. CAV. PR. 

457 

NE 

NE 

NE 

NE 

NE 

NE 

7 

HPOTP DIS. PRESS. 

90 

NE 

NE 

NE 

NE 

NE 

NE 

8 

HPOTPT. DIS. TEMP. 

233,234 

NE 

+1.1 °F/PSI 

-0.68°F/PSI 

NE 

NE 

NE 

9 

HPOTP INT. SEAL PUR. 
PRESS. 

211,212 

NE 

NE 

NE 

NE 

NE 

NE 

1° 

HPOTP SEC. SEAL DR. 
PRESS. 

91-92 

NE 

NE 

NE 

NE 

NE 

NE 

11 

HPOTP BOOSTPUMP 
DIS. PR. (PBP DIS. PR.) 

59,159,341 

NE 

+1 PSI/PSI 

-1 PSI/PSI 

+20PSI 

-20PSI 

NE 

12 

HPOTP BOOSTPUMP 
RAD.ACCEL (PBP 
RAD ACCEL) 

1994-1996 

NE 

NE 

NE 

NE 

NE 

NE 

13 

HPOTP BOOSTPUMP 
BRNG COOL. DIS. TEMP. 

183,8251,8255 

NE 

NE 

NE 

NE 

NE 

NE 

14 

LPFTP SPEED 

32,754,735 

+3.7 RPM/PSI 

+0.85 RPM/PSI 

-0.6 RPM/PSI 

+90RPM 

-90RPM 

NE 

!5 

LPOTP DIS. PR. 

302 

NE 

-0.83 PSI/PSI 

+0.9 PSI/PSI 

NE 

NE 

NE 

16 

HEX VENT DP 

883,8352 

NE 

+0.07 PSI/PSI 

-0.078 PSI/PSI 

NE 

NE 

-68PSI 

17 

HEX INTERFACE TEMP. 

252,8359 

NE 

NE 

-1° F/PSI 

NE 

NE 

NE 

18 

MCC PRESS 

129,130 

NE 

NE 

NE 

NE 

NE 

NE 

19 

MCC LINK CAV PRESS. 

1951 

NE 

NE 

NE 

NE 

NE 

NE 

20 

OPOV ACT POSIT. 

40 

NE 

+0.022 %/PSI 

-0.017%/PSI 

NE 

NE 

NE 

21 

FPOV ACT. POS. 

42 

NE 

-0.015 %/PSI 

+0.007 %/PSI 

NE 

NE 

NE 

22 

FUEL FLOW 

251.253.721 

258.133.722 

NE 

NE 

NE 

NE 

NE 

NE 
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TABLE 3. 

POWER BALANCE MODEL 
GAINS FOR +1 PSI LOX 
INLET PRESSURE 


GAINS 


PID NO. 

PARAM. NO. 

PARAM. TITLE 

109%PL 

104%PL 

100%PL 

260,261 

4360 

HPFP SPEED 

-0.1618 

-0.1791 

-0.1887 

231,232 

4629 

HPFT DIS T 

0.0997 

0.1068 

0.1122 

233,234 

4638 

HPOT DIS T 

-0.3945 

-0.4135 

-0.4253 

52 

4902 

HPFP DIS P 

-0.1000 

-0.0996 

-0.0978 

90 

4903 

HPOPDIS P 

0.0015 

0.0014 

0.0013 

59 

4915 

PBP DIS PR 

-0.4435 

-0.4406 

-0.4439 

32 

4359 

LPFP SPEED 

-0.2488 

-0.2529 

-0.2530 

302 

4912 

LPOP DIS P 

0.8833 

0.8810 

0.8799 

40 

4798 

OPOV POS 

-0.0001 

-0.0001 

-0.0001 

42 

4799 

FPOV POS 

0.0001 

0.0001 

0.0001 

129,130 

4079 

MCC PC 

0.0 

0.0 

0.0 

251,253 

4542 

FUEL VOL FI 

0.0 

0.0 

0.0 
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Table 4. 

LOX Venting/Repressurization Gain Values 



1 





( 




TEST NO. 

1902-398 

901-511 

901-551 

901-683 

902-519 

902-532 

902-428 

902-249 

901-364 

750-175 

P.L (V.RPL) 


104 

104 

104 

104 

104 

1 04 

104 

109 

109 

109. Ill 













LD. NO. 

PARAMETER 











1 

HPFP RAD ACCEL (GRMS) 

ne 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

2 

HPFP BAL CAV PRES (PSIG) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

3 

HPOP 01S PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

4 

HPOP IMSL PURGE PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

s 

HPOP SEC SEAT. CAV PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

6 

PBP DIS PRES (PSIA) 

*2 

-1 

•1 

•1.2 

-1 

-2 

-1 

-2 

-2 

-2 

7 

PBP RAD ACCEL (GRMS) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

8 

PBP BEAR CLNT DIS TEMP (DEG R) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

9 

MCC PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

[ne 

NE 

10 

MCC CAV LNR PRES (PSIG) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

IE 

11 

HPFP SPEED (RPM) 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

NE 

NE 

NE 

12 

HPFTDST1 A(DEGR) 

0.6 

0.2 

0.5 

0.3 

0.5 

0.31 0.2 

0.61 0.41 0.4 

13 

HPFTDST1 B(DEGR) 

0.6 

0.2 

0.5 

0.3 

0.5 

0.51 0.2 

0.6 

0.41 0.4 

14 

HPOTDST1 (DEGfl) 

-1.2 

-1 

•1 

-1.2 

-1 

-1.81 -0.81 -1.21 -1.2! -1.2 

IS 

HPOT DS T2 (DEG R) 

•1.2 

-1 

-1 

-1.21 -1 

-1.81 -0.81 -1.2 

-1.2 

■ 1.2 

16 

LPFP SPEED (RPM) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

IE 

17 

LPOP DIS PRES (PSIA) 

1.41 1.4 

1.4 

1 ,4i 1.4 

1,2i 1 .4| 1.41 1.41 1.4: 

18 

HPFT DIS PRES (PSIA) 

-0.25 

-0.25 

-0.25 

-0.251 -0.25 

•0.25IN/A 

NM 

In /a 

NE 

19 

HPFP CLNT LNR PRES (PSIA) 

NE 

NE 

NE 

NE 

INE 

NE 

NE 

NE 

NE 

NE 

20 

HEX INTTEMP (DEG F) 

-1 

-0.4 

-1 

-1 

-1 

-1 

-1 .2| -1.21 -0.61 -0.6 

21 

IHEX VENT DP (PSIG) 

-0.078 

-0.078 

-0.078 

-0.078 

-0.078 

-0.0681 -0.021 -0.068 i ■ *0.031 

22 

[OPOV ACT POS (PCNT) 

•0.0221 -0.022 

-0.022 

-0.0221 -0.022 

-0.0151 -0.0011 -0.015 

-0.0151 -0.015 

23 

IFPOV ACT POS (PCNT) 

0.014 

0.014 

0.014 

0.0141 0.014 

0.0141 0.001 

0.0161 0.016 

0.016 

24 

1 FUEL FLOW (GPM) 

NE 

NE 

NE 

NE 

m 

NE 

'NE 

J§ 

IE 

NE 


1 




1 1 i l ■ : 


N/A - not available 
NE - no effect 


Table 5. 

Fuel Venting/Repressurization Gain Values 








1 

1 i 

1 

TEST NO. 


902 

-398 

901-511 

901-551 

901*683 

902-519 

902*532 

902-428 

902-249 

901 

-364 1901-173 i 

P.L (%RPL) 


104 

104 

104 

104 

104 

104 

104 

109 

109170, 92 







i 



1 

I.D. NO. 

PARAMETER 


i 



1 


1 

i 

HPFP RAD ACCEL (GRMS) 

NE 

NE 

NE 

NE 

NE 

M 

NE 

NE 

NE 


NE 1 

2 

HPFP BAL CAV PRES (PSIG) 

NE 

NE 

IE 

NE 

NE 

NE INE 

NE 

NE 

INE I 

3 

HPOP DIS PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

4 

HPOP IMSL PURGE PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

5 

HPOP SEC SEAL CAV PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


IE 

6 

PBP DIS PRES (PSIA) 

NE 

IE 

NE 

NE 

NE 

IE 

NE 

NE 

NE 

INE i 

7 

PBP RAD ACCEL (GRMS) 

NE 

NE 

IE 

NE 

NE 

NE INE 

NE 

NE 


NE 1 

a 

PBP BEAR CLNT DIS TEMP (OEG R) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

INE 1 

9 

MCC PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

IE 

NE 


NE 

10 

MCC CAV LNR PRES (PSIG) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

11 

HPFP SPEED (RPM) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

INE 1 

12 

HPFT DST1 A(DEGR) 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

NE 

NE 


NE .. ! 

13 

HPFT DS T1 B (DEG R) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

INE 

14 

HPOT DST1 (OEG R) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

INE 

IS 

HPOT DST2 (DEG R) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

16 

Li H SPEED (RPM) 

-3.7 

-3.7 

-3.7 

-3.7 

-3.71 -3.7 

-3.7 

-3.7 


-3.7 

-3.7 

17 

LPOP DIS PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

18 

HPFT DIS PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


NE 

19 

HPFP CLNTT LNR PRES (PSIA) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

20 

HEX INTTEMP (DEG F) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

21 

HEX VENT DP (PSIG) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

22 

OPOV ACT POS (PCNT) 

NE 

NE 

NE 

NE 

NE 

IE 

NE 

NE 

NE 

NE 

23 

FPOV ACT POS (PCNT) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

24 

FUEL FLOW (GPM) 

NE 

NE 

NE 

NE 

NE 

NE 

NE 

NE 


INE 


N/A - not available 
NE - no effect 
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Table 6. 

GOX Repressurization Valve Closure Effects 













TEST NO. 


902-398 

901-511 

901-551 

901-683 

902-519 

902-532 

902-428 

902-249 

901-364 

P.L. (%RPL) 


104 

104 

104 

104 

104 

1 04 

1 04 

109 

109 












I.D. NO. 

PARAMETER 










1 

HPFP RAD ACCEL (GRMS) 

AE 

AE 

IE 

AE 

IE 

AE 

AE 

AE 

IE 

2 

HPFP BAL CAV PRES (PSIG) 

AE 

AE 

AE 

AE 

IE 

AE 

AE 

IE 

AE 

3 

HPOP OIS PRES (PSIA) 

IE 

AE 

AE 

AE 

AE 

AE 

IE 

AE 

IE 

4 

HPOP IMSL PURGE PRES (PS!A) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

S 

HPOP SEC SEAL CAV PRES (PSIA) 

AE 

AE 

AE 

AE 

IE 

AE 

AE 

AE 

IE 

6 

PBP DIS PRES (PSIA) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

NE 

AE 

7 

PBP RAD ACCEL (GRMS) 

IE 

AE 

AE 

AE 

AE 

AE 

IE 

AE 

AE 

a 

PBP BEAR CLNT DIS TEMP (OEG R) 

IE 

IE 

AE 

AE 

AE 

AE 

AE 

IE 

IE 

9 

MCC PRES (PSIA) 

IE 

IE 

AE 

AE 

AE 

AE 

IE 

IE 

AE 

10 

MCC CAV LNR PRES (PSIG) 

AE 

IE 

AE 

AE 

AE 

IE 

AE 

AE 

AE 

11 

HPFP SPEED (RPM) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

IE 

IE 

12 

HPFTDST1 A(DEGR) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

13 

HPFTDST1 B (DEG R) 

IE 

AE 

IE 

AE 

AE 

AE 

AE 

AE 

IE 

14 

HPOTDST1 (DEG R) 

AE 

AE 

AE Iae 

AE 

IE 

AE 

AE 

IE 

15 

HPOT OS T2 (DEG R) 

AE 

IE 

IE IAE 

AE 

AE 

IE 

AE IIE 

16 

LPFP SPEED (RPM) 

IE 

AE 

AE IAE 

AE 

AE 

AE 

AE IAE 

17 

LPOP DIS PRES (PSIA) 

AE 

IE 

AE IAE 

AE 

AE 

AE 

AE IIE 

18 

HPFT DIS PRES (PSIA) 

IE 

AE 

AE IAE 

AE 

AE 

AE 

AE IAE 

19 

HPFP CLNT LNR PRES (PSIA) 

AE 

AE 

AE IAE 

AE 

AE 

AE 

AE IAE 

20 

HEX INTTEMP (DEG F) 

IE 

AE IAE IIE IAE 

IE 

AE 

AE 

AE 

21 

HEX VENT DP (PSIG) 

-681 -681 -681 -681 -681 -68 

N/A 

N/A 

N/A 

22 

OPOV ACT POS (PCNT) 

AE !ie Iae iae [ie iae 

AE 

AE 

IE 

23 

FPOV ACT POS (PCNT) 

AE 

AE IAE |AE 

ie Iae 

IE 

AE 

AE 

24 

FUEL FLOW (GPM) 

AE 

AE Iae IIE 

ie iie 

IE 

AE IAE 


N./A - not available 
NE - no effect 


Table 7- 

Fuel Repressurization Valve Closure Effects 


1 

; 1 i 



1 1 

TEST NO. | 

902-398 1901-511 1901-551 1901-683 

902-519 

902-532 

902-428 

902-249 |901-364 

P.L (T4RPL) 

1041 1041 1041 104 

104 

104 

104 

1091 109 

1 



1 






I.D.NO. 1 PARAMETER 



[ 


— 




1 HPFP RAD ACCEL (GRMS) 

AE 

AE 

IE INE 

AE 

AE 

AE 

AE flE 

2 HPFP BAL CAV PRES (PSIG) 

AE 

AE 

AE IAE 

IE 

AE 

AE 

IE IAE 

3IHPCPDIS PRES (PSIA) 

AE 

AE 

IE IAE 

AE 

AE 

AE 

AE 

NE 

4 HPOP IMSL PURGE PRES (PSIA) 

AE 

AE 

AE IAE 

IE 

AE 

AE 

IE 

AE 

5 HPOP SEC SEAL CAV PRES (PSIA) 

AE 

AE 

_ 

AE 

IE 

AE 

AE 

AE 

6 PBP DIS PRES (PSIA) 

-201 -20 

-201 -20 

-20 

-20 

N/A 

N/A 

N/A 

7 PBP RAD ACCEL (GRMS) 

AE 

AE 

AE 

AE 

AE 

AE 

NE 

AE 

AE 

a |PBP BEAR CLNT DIS TEMP (DEG R) 

AE 

AE 

AE 

AE 

AE 

IE 

AE 

IE 

AE 

9IMCC PRES (PSIA) 

AE 

AE 

AE IAE 

A £ 

AE 

AE 

AE 

AE 

1 0lMCC CAV LNR PRES (PSIG) 

AE 

AE 

AE Iae 

IE 

AE 

AE 

AE 

AE 

nlHPFP SPEED (RPM) 

AE 

IE 

ae Iae 

AE 

AE 

AE 

AE 

IE 

12IHPFTDST1 A(DEGR) 

AE 

IE 

AE IAE 

AE 

AE 

AE 

AE 

AE 

13IHPFTDST1 B(DEGR) 

IE 

AE 

AE 'AE 

AE 

AE 

AE 

AE IIE 

14IHPOTDST1 (DEGR) 

AE 

IE 

AE IAE 

AE 

AE 

AE 

AE [AE 

1 5IHPOTOST2 (DEG R| 

AE 

AE 

AE INE 

AE 

AE 

AE 

AE INE 

16ILPFP SPEED (RPM) 

-90 

-90 

-901 -90 

-90 

•90 

N/A 

N/A 

N/A 

17ILPOP DIS PRES (PSIA) 

AE 

AE 

AE 

AE 

IE 

AE 

AE 

IE 

IE 

lalHPFTDIS PRES (PSIA) 

AE 

IE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

1 91 HPFP CLNT LNR PRES (PSIA) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

IE 

20IHEX INTTEMP (DEGR 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

NE 

21 HEX VENT DP (PSIG) 

AE 

AE 

AE 

IE 

AE 

AE 

AE 

AE 

AE 

2 2 OPOV ACT POS (PCNT) 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

AE 

23IFPOV ACT POS (PCNT) 

IE 

IE 

AE IAE 

AE 

AE 

AE 

AE 

AE 

24IFUEL FLOW (GPM) 

AE 

AE 

AE IAE 

AE 

IE 

AE 

AE 

AE 


N/A - not available 
NE - no effect 
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Table 8. 

Pre -Computed Average Values 


1 

i i i r i i i 

. , 

1 . _ 

1 

TEST NO. 

902*398 1901 

511 1901-551 1901*883 

902*519 {902*532 1902*428 >902-249 

901*364 >750* 

175 1750-175 

901-183 901 

Tto 1 

901 

173 

P.L. 

1041 

1041 

1041 

104 

1041 

1041 

1G4i 

109 

1091 

1 091 

111 

92 

70 

92 


i 





LO. NO. PARAMETER 

1 

I 




1|HPFPRADACCEL/GRMS) 

4.91| 

4.91 

4.91 1 

4.91 

4.91 

4.911 

4.91 1 

5.12 

5.121 

»-’2l 

5.12 

3.041 

1.5 

5.1 

2 1 HPFP BAL CAV PRES (PSJG) 

49751 

4810 

48101 

4810 

4880 

4880 

4810 

5078 



4203) 

3160 

4070 

3 iHPOP OtS PRES (PStAJ 

4090 

4Q9oi 

4090( 

4090 

4090 

40901 

4090i 

4300 

4300! 

4300 

4300 

38001 

2895 

3700 

* HPOP MSL PURGE PRES (PSA) 

230 

23ol 

2301 

230 

230 

2301 

2301 

246 

24&I 

246 

248 

2281 

449 

448 

5 (KPOP SEC SEAL CAV PRES (PSJA) 

231 

231 

23i 

23 

231 

2 si 

23l 

20.5 

20.5| 

20.5 

20.5IN/A IN/ A 


N/A 

6 PBPDBPRES/PSIAl 

7489| 

7489 

74891 

7489 

7489 

74891 

74891 

7757 

7757 

7757 

7757 

8300 

4850 

8280 

7|PBP RAO ACCEL{GRMS! 

2.2] 

2.2 

2.21 

2.2 

2.2 

2.2 

2.2i 

2.88 

2.68 

2.68 

2.68 

1.44 

2.5 

3.15 

* •!PBPflEARCLNTDS7B^P(OEOfl) 

N/A IN/ A 

(N/A 

iN/A 


N/A N/A 

IN/A 

IN/A 


n/a In/a 

N/A 


N/A N/A 


N/A 

9 1 MCC PRES (PS!A) 

31271 

3127 

3127| 

3127 

3127 

3127 

31271 

3260 

32801 

3280 

3260 

2700 

2070 

r 2720 

1 0|MCC CAVLNR PRES(PSG) 

• 6 

7.8 

7.si 

*5 

•10 

*ioi 

7.81 

-5 

•SI 

-5 

-5IN/A IN/A 


N/a 

lllHfPsreEDIWM 

35 1 Oo| 

35320 

353201 

353201 351001 

351001 

353201 

36800 

368001 

36800 

36800 

33500 

28800 

33150 

12IHPFT OSTt A (OEQ RJ 

17021 

1702 

1 702 1 

1702 

1702 

17021 

17021 

1600 

1800! 

1800 

1800 

1800 

1550 

1730 

13IHPfTD3Tl B(OEQR) 

188SI 

1665| 

18651 

1885 

1665 

1 6651 

18851 

1650 

19001 

1900 

1900 

1000 

17801 

1880 

lAlHPOTOSTl (DEQRV 

13001 

14281 

14261 

1426 

1300 

1 4501 

14281 

1293 

12931 

!293 

1293 

1142 

1290! 

1370 

1fi(HPOT03T2(DEQ R) 

15001 

15001 

15001 

1500 

1350 
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TEST 902-398. 10*5. «/ LOX/HJEL /ENTiNG. 23/31/92 ■! 
TEST 902- 398. *0*5. */ LOX^UEL /EM77NG. 23/31/92 . 



g. J—g jB*-r EJ - —a -f-G - - -3 -4*3 -—3- ---3- — 3- -3 











H.V. PANOSSIAN (bn/3/92 

SSME REAL-TIME FAILURE CONTROL SCHEDULE 



4.1 PERIOD REPORTS 




